latex-renderer

LaTeX Renderer System

🔒 CRITICAL SECURITY REQUIREMENTS

DOMPurify sanitization MUST be active in LatexRenderer.jsx. Processes untrusted LLM output — XSS risk without it.

Required implementation:

• import DOMPurify from 'dompurify'; in LatexRenderer.jsx
• DOMPURIFY_CONFIG constant defined (see below)
• renderedHtmlSmall useMemo (single chunk) and per-chunk renderedHtml useMemo both call DOMPurify.sanitize() AFTER renderLatexToHtml()
• dangerouslySetInnerHTML receives ONLY sanitized HTML

DOMPurify Configuration (REQUIRED)

const DOMPURIFY_CONFIG = {
  ALLOWED_TAGS: [
    'div', 'span', 'p', 'br', 'hr', 'strong', 'b', 'em', 'i', 'u', 's', 'sub', 'sup', 'small',
    'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'dl', 'dt', 'dd',
    'table', 'thead', 'tbody', 'tr', 'th', 'td',
    'math', 'semantics', 'mrow', 'mi', 'mo', 'mn', 'msup', 'msub', 'mfrac', 'mroot', 
    'msqrt', 'mtext', 'mspace', 'mtable', 'mtr', 'mtd', 'annotation', 'annotation-xml',
    'svg', 'path', 'line', 'rect', 'circle', 'g', 'use', 'defs', 'clippath',
  ],
  ALLOWED_ATTR: [
    'class', 'id', 'title', 'style',
    'mathvariant', 'encoding', 'xmlns', 'displaystyle', 'scriptlevel',
    'columnalign', 'rowalign', 'columnspacing', 'rowspacing', 'stretchy',
    'symmetric', 'fence', 'separator', 'lspace', 'rspace', 'accent',
    'accentunder', 'movablelimits', 'minsize', 'maxsize', 'width', 'height',
    'd', 'viewBox', 'preserveAspectRatio', 'fill', 'stroke', 'stroke-width',
    'transform', 'x', 'y', 'dx', 'dy', 'x1', 'y1', 'x2', 'y2', 'r', 'cx', 'cy',
    'href', 'xlink:href', 'clip-path',
  ],
  ALLOW_DATA_ATTR: false,
  ALLOW_ARIA_ATTR: false,
  FORBID_TAGS: ['script', 'iframe', 'object', 'embed', 'form', 'input', 'button', 'textarea', 'select', 'option', 'link', 'style', 'base', 'meta'],
  FORBID_ATTR: ['onerror', 'onclick', 'onload', 'onmouseover', 'onfocus', 'onblur', 'onchange', 'onsubmit', 'onkeydown', 'onkeyup', 'onmousedown', 'onmouseup'],
  SANITIZE_DOM: true,
};